Sendle Shipping Plugin
Sendle Shipping Plugin has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Missing Authorization.
Every one of the 3 issues recorded for Sendle Shipping Plugin has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Sendle Shipping Plugin is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2023-45761Sendle Shipping <= 5.17 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Sendle Shipping Plugin
Author
Joovii
Sendle is an award-winning, 100% carbon neutral, door-to-door shipping carrier, designed to help small businesses thrive with simple, reliable, affordable shipping. This app (tested and approved by Sendle) provides the basic connectivity between WooCommerce and Sendle. For the ultimate connectivity and features, please install the Premium Plugin. By integrating Sendle with your WooCommerce store, you get instant shipping quotes, order confirmation, and easy tracking updates. The app provides: * Automatic shipping quotes and outstanding Sendle service throughout the US * Woocommerce Shipping Method Compatibility with WooCommerce Shipping Zones * Parcel tracking * Ability to connect orders to generate shipments in Sendle * Easy order cancellation directly from the admin panel * The option to generate Sendle shipments automatically on receipt of new orders * Ability to add shipping quote markup (%) with admin access * Default customer pickup instructions if required * The option to add Additional Handling Fee * Quotation for cart weight/volume > sendle’s max weight/volume. * Send tracking email to the customer. * Update tracking email template. * Separate satchel booking at the order details page for Australia. * Split handling fee for tax option. Additional info on what’s available on the app: * Parcel Tracking shortcode [sendle_tracking] * Backwards compatibility for methods existing before zones existed * Receipt of tracking ID from Sendle and store on order details * Real tracking information in the admin and customer account from Sendle API * Parcel Tracking widget * Ability to download label size [Letter or Cropped] from admin order details page * Admin view of Sendle shipping details in admin order details page * Admin can also set default [Sender Pickup instructions] * Admin can set sender name, contact number, address, suburb, state, postcode * Admin can set Show the rates in frontend [If not then the rates will not show in frontend but backend process will work for other shipping methods] * Admin can set Post to Sendle API for the selected other shipping methods [Flat rate and Free Shipping] Disclosure We are using https://api.sendle.com or https://sendle-sandbox.herokuapp.com url call to get shipping rate from sendle and post shipment to the sendle. We are also using http://api.geonames.org url call to show zipcode-city suggestion in checkout. We are also using http://plugins.joovii.com url call to update the joovii database to provide the best support.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C